top of page

Subscribe to our newsletter

Apple Urgently Patches WebKit Zero-Day Vulnerabilities Exploited in Targeted Attacks Affecting iOS, macOS, and Safari

  • Rescana
  • 2 days ago
  • 3 min read
Image for post about Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild

Rescana Cybersecurity Threat Intelligence Report

Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild

Date: December 13, 2025Prepared by: Rescana OSINT Cybersecurity Research Team


Executive Summary

Apple has released emergency security updates to address two zero-day vulnerabilities in WebKit, the browser engine powering Safari and all browsers on iOS. Both vulnerabilities (CVE-2025-43529 and CVE-2025-14174) have been confirmed as exploited in the wild in highly targeted, sophisticated attacks. The flaws affect a wide range of Apple devices, including iPhones, iPads, Macs, Apple Watch, Apple TV, and Vision Pro. Google has also patched the same vulnerability in Chrome for Mac, indicating a coordinated disclosure.


Vulnerability Details

1. CVE-2025-43529

  • Type: Use-after-free in WebKit

  • Impact: Remote Code Execution (RCE) via malicious web content

  • Discovery: Google Threat Analysis Group

  • Affected Devices:

  • iPhone 11 and later

  • iPad Pro 12.9-inch (3rd gen and later)

  • iPad Pro 11-inch (1st gen and later)

  • iPad Air (3rd gen and later)

  • iPad (8th gen and later)

  • iPad mini (5th gen and later)

  • macOS, tvOS, watchOS, visionOS, Safari

2. CVE-2025-14174

  • Type: Out-of-bounds memory access in ANGLE (WebKit/Chrome)

  • Impact: Remote Code Execution (RCE) via crafted HTML page

  • Discovery: Apple Security Engineering and Architecture (SEAR) and Google Threat Analysis Group

  • CVSS v3.1 Score: 8.8 (High)

    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

  • References:

  • NVD Entry

  • CISA KEV Catalog

  • Chrome Advisory

  • Chromium Issue Tracker


Exploitation in the Wild

  • Nature of Attacks:

  • Apple and Google both report "extremely sophisticated" and "highly targeted" exploitation, likely by advanced threat actors (APT).

  • Attacks were observed against specific individuals, not mass exploitation.

  • Exploitation occurred on iOS versions prior to iOS 26.

  • The attack chain is consistent with spyware delivery, leveraging malicious web content to trigger RCE.

  • APT/Threat Actor Attribution:

  • No public attribution to a specific APT group as of this report.

  • The use of WebKit zero-days in targeted attacks is consistent with past campaigns by state-sponsored actors (e.g., NSO Group, APT41, APT28), but no direct evidence links these groups to the current exploitation.

  • Indicators of Compromise (IOCs):

  • No public IOCs have been released by Apple or Google as of this report.

  • Exploitation is triggered by visiting a malicious or compromised website.


Technical References & Proof-of-Concepts


MITRE ATT&CK Mapping

  • Tactic: Initial Access (TA0001)

  • Technique: Drive-by Compromise (T1189)

  • Sub-technique: Exploit Public-Facing Application (T1190)

  • Potential Use: Delivery of spyware or surveillance malware via malicious web content.


Mitigation Strategies


Additional Notes

  • No public PoC exploits have been released as of this report.

  • No mass exploitation has been observed; attacks are highly targeted.

  • No confirmed breach disclosures from organizations, but individuals targeted may be at risk of surveillance or data theft.


References


About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and risk analytics empower security teams to proactively defend against emerging threats and ensure the resilience of their business operations. For more information or to discuss how our solutions can enhance your security posture, we are happy to answer questions at ops@rescana.com.

bottom of page